По дате публикации
Эксплуатируемые и новые серьёзные CVE: сентябрь 2025 г.
198 записей · 16 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
12Наблюдать | CVE-2025-10440Эксплойта нет | D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injectiond-link · di-8100 · CWE-77 | Низкая2,1 | — | 13,3 % | 15 сент. 2025 г. |
39Наблюдать | CVE-2025-46408Proof of concept | An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpCavtech · eagleeyes\(lite\) · CWE-297 | Критическая9,8 | — | 0,6 % | 15 сент. 2025 г. |
35Наблюдать | CVE-2025-50110Proof of concept | An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse mCWE-319 | Высокая8,8 | — | 0,2 % | 15 сент. 2025 г. |
35Наблюдать | CVE-2025-50944Proof of concept | An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0.avtech · eagleeyes\(lite\) · CWE-295 | Высокая8,8 | — | 0,2 % | 15 сент. 2025 г. |
12Наблюдать | CVE-2025-10441Эксплойта нет | D-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injectiond-link · di-8100g · CWE-77 | Низкая2,1 | — | 13,7 % | 15 сент. 2025 г. |
28Наблюдать | CVE-2025-6202Proof of concept | Phoenix: Rowhammer attack on Hynix DDR5 devicessk hynix · ddr5 · CWE-404 | Высокая7,1 | — | 0,3 % | 15 сент. 2025 г. |
40В плане | CVE-2025-57174Proof of concept | An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previoCWE-321 | Критическая9,8 | — | 2,2 % | 15 сент. 2025 г. |
26Наблюдать | CVE-2025-57176Proof of concept | On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP poceragon networks / siklu communication · etherhaul and multihaul series microwave antennas · CWE-434 | Средняя6,5 | — | 0,4 % | 15 сент. 2025 г. |
21Наблюдать | CVE-2025-59376Proof of concept | feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delefeisky · mcp-kubernetes-server · CWE-77 | Средняя5,3 | — | 0,3 % | 15 сент. 2025 г. |
21Наблюдать | CVE-2025-9808Proof of concept | The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosurestellarwp · the events calendar · CWE-200 | Средняя5,3 | — | 0,8 % | 16 сент. 2025 г. |
17Наблюдать | CVE-2025-2404Proof of concept | XSS in Ubit Information Technologies' STOYSubit information technologies · stoys · CWE-79 | Средняя4,3 | — | 0,2 % | 16 сент. 2025 г. |
39Наблюдать | CVE-2025-4688Proof of concept | SQLi in BGS Interactive's SINAV.LINK Exam Result Modulebgs interactive · sinav.link exam result module · CWE-89 | Критическая9,8 | — | 0,4 % | 16 сент. 2025 г. |
30Наблюдать | CVE-2025-41249Proof of concept | CVE-2025-41249: Spring Framework Annotation Detection Vulnerabilityvmware · spring framework · CWE-285 | Высокая7,5 | — | 0,4 % | 16 сент. 2025 г. |
60На этой неделе | CVE-2009-20005Готовый эксплойт | InterSystems Caché UtilConfigHome.csp Stack Buffer Overflowintersystems corporation · intersystems caché · CWE-121 | Критическая9,3 | — | 1,6 % | 16 сент. 2025 г. |
60На этой неделе | CVE-2009-20006Готовый эксплойт | osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Executionoscommerce · oscommerce · CWE-434 | Критическая9,3 | — | 1,6 % | 16 сент. 2025 г. |
60На этой неделе | CVE-2009-20007Готовый эксплойт | Talkative IRC v0.4.4.16 Response Buffer Overflowtalkative · talkative irc · CWE-121 | Критическая9,3 | — | 1,6 % | 16 сент. 2025 г. |
41В плане | CVE-2025-41243Proof of concept | Spring Expression Language property modification using Spring Cloud Gateway Server WebFluxspring · cloud gateway · CWE-94 | Критическая10,0 | — | 3,6 % | 16 сент. 2025 г. |
26Наблюдать | CVE-2025-9215Proof of concept | StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Downkodezen · storeengine — complete ecommerce solution with memberships, licensing, affiliates & more · CWE-22 | Средняя6,5 | — | 0,6 % | 17 сент. 2025 г. |
35Наблюдать | CVE-2025-9216Proof of concept | StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Uplokodezen · storeengine — complete ecommerce solution with memberships, licensing, affiliates & more · CWE-434 | Высокая8,8 | — | 0,8 % | 17 сент. 2025 г. |
95Срочно | CVE-2025-9242Готовый эксплойт | WatchGuard Firebox iked Out of Bounds Write Vulnerabilitywatchguard · fireware · CWE-787 | Критическая9,3 | KEV | 92,2 % | 17 сент. 2025 г. |
27Наблюдать | CVE-2025-59456Эксплойта нет | In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive uploadjetbrains · teamcity · CWE-23 | Средняя5,5 | — | 15,4 % | 17 сент. 2025 г. |
30Наблюдать | CVE-2025-10042Proof of concept | Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injectionays-pro · quiz maker · CWE-89 | Высокая7,5 | — | 0,9 % | 17 сент. 2025 г. |
23Наблюдать | CVE-2025-59474Proof of concept | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible tjenkins · jenkins · CWE-862 | Средняя5,3 | — | 5,0 % | 17 сент. 2025 г. |
26Наблюдать | CVE-2025-57055Proof of concept | WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality.wondercms · wondercms · CWE-918 | Средняя6,5 | — | 0,4 % | 17 сент. 2025 г. |
30Наблюдать | CVE-2025-59341Proof of concept | Local File Inclusion in esm.shesm-dev · esm.sh · CWE-23 | Высокая7,7 | — | 1,6 % | 17 сент. 2025 г. |
23Наблюдать | CVE-2025-59342Proof of concept | esm.sh writes arbitrary files via path traversal in `X-Zone-Id` headeresm-dev · esm.sh · CWE-24 | Средняя5,5 | — | 3,1 % | 17 сент. 2025 г. |
11Наблюдать | CVE-2025-10628Эксплойта нет | D-Link DIR-852 Web Management hedwig.cgi command injectiondlink · dir-852 firmware · CWE-74 | Низкая2,1 | — | 10,0 % | 17 сент. 2025 г. |
21Наблюдать | CVE-2025-10493Proof of concept | Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookieprasunsen · chained quiz · CWE-639 | Средняя5,3 | — | 0,9 % | 18 сент. 2025 г. |
34Наблюдать | CVE-2025-40677Proof of concept | SQL injection vulnerability in Summar Software´s Portal del Empleadosummar software · portal del empleado · CWE-89 | Высокая8,7 | — | 0,6 % | 18 сент. 2025 г. |
30Наблюдать | CVE-2025-10666Proof of concept | D-Link DIR-825 apply.cgi sub_4106d4 buffer overflowdlink · dir-825 firmware · CWE-119 | Высокая7,4 | — | 3,3 % | 18 сент. 2025 г. |
26Наблюдать | CVE-2025-55911Proof of concept | An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameteroxygenz · clipbucket · CWE-77 | Средняя6,5 | — | 1,0 % | 18 сент. 2025 г. |
35Наблюдать | CVE-2023-49367Proof of concept | An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent paCWE-200 | Высокая8,8 | — | 0,3 % | 18 сент. 2025 г. |
29Наблюдать | CVE-2025-55912Proof of concept | An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php toxygenz · clipbucket · CWE-434 | Высокая7,3 | — | 1,5 % | 18 сент. 2025 г. |
29Наблюдать | CVE-2025-59424Proof of concept | LinkAce Vulnerable to Stored XSS on the Audit Pagelinkace · linkace · CWE-79 | Высокая7,3 | — | 0,3 % | 18 сент. 2025 г. |
99Срочно | CVE-2025-10035Готовый эксплойт | Deserialization Vulnerability in GoAnywhere MFT's License Servletfortra · goanywhere managed file transfer · CWE-77 | Критическая9,8 | KEV | 99,8 % | 18 сент. 2025 г. |
21Наблюдать | CVE-2025-59712Proof of concept | Snipe-IT before 8.1.18 allows XSS.snipeitapp · snipe-it · CWE-79 | Средняя5,4 | — | 0,2 % | 18 сент. 2025 г. |
96Срочно | CVE-2025-48703Готовый эксплойт | CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in tcontrol-webpanel · webpanel · CWE-78 | Критическая9,0 | KEV | 99,6 % | 19 сент. 2025 г. |
24Наблюдать | CVE-2025-56762Proof of concept | Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php.paracrawl · keops · CWE-79 | Средняя6,1 | — | 0,2 % | 19 сент. 2025 г. |
60На этой неделе | CVE-2025-59689Готовый эксплойт | Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment.libraesva · email security gateway · CWE-77 | Средняя6,1 | KEV | 1,9 % | 19 сент. 2025 г. |
31Наблюдать | CVE-2025-39866Proof of concept | fs: writeback: fix use-after-free in __mark_inode_dirty()linux · linux kernel · CWE-416 | Высокая7,8 | — | 0,3 % | 19 сент. 2025 г. |
26Наблюдать | CVE-2025-10658Proof of concept | SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeoverpsmplugins · supportcandy – helpdesk & customer support ticket system · CWE-307 | Средняя6,5 | — | 0,3 % | 20 сент. 2025 г. |
8Наблюдать | CVE-2025-10771Эксплойта нет | jeecgboot JimuReport DB2 JDBC testConnection deserializationjeecg · jimureport · CWE-20 | Низкая2,1 | — | 0,6 % | 21 сент. 2025 г. |
13Наблюдать | CVE-2025-10775Эксплойта нет | Wavlink WL-NU516U1 login.cgi sub_4012A0 os command injectionwavlink · wl-nu516u1 firmware · CWE-77 | Низкая2,0 | — | 16,6 % | 21 сент. 2025 г. |
28Наблюдать | CVE-2025-9983Proof of concept | Lack of Authentication for RTSP streamgalayou · g2 · CWE-306 | Высокая7,1 | — | 0,6 % | 22 сент. 2025 г. |
25Наблюдать | CVE-2025-55885Proof of concept | SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate priard · gec en ligne · CWE-89 | Средняя6,3 | — | 0,3 % | 22 сент. 2025 г. |
26Наблюдать | CVE-2025-55886Proof of concept | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD.CWE-693 | Средняя6,5 | — | 0,3 % | 22 сент. 2025 г. |
29Наблюдать | CVE-2025-55888Proof of concept | Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD.ard · gec en ligne · CWE-79 | Высокая7,3 | — | 0,4 % | 22 сент. 2025 г. |
40В плане | CVE-2025-52367Готовый эксплойт | Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field.pivotx · pivotx · CWE-79 | Средняя5,4 | — | 4,4 % | 22 сент. 2025 г. |
24Наблюдать | CVE-2025-55887Proof of concept | Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD.ard · gec en ligne · CWE-79 | Средняя6,1 | — | 0,3 % | 22 сент. 2025 г. |
26Наблюдать | CVE-2025-57926Proof of concept | WordPress Passster Plugin <= 4.2.18 - Cross Site Scripting (XSS) Vulnerabilitywp chill · passster · CWE-79 | Средняя6,5 | — | 0,2 % | 22 сент. 2025 г. |
21Наблюдать | CVE-2025-58226Proof of concept | WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure Vulnerabilityiberezansky · 3d flipbook – pdf flipbook viewer, flipbook image gallery · CWE-201 | Средняя5,3 | — | 0,7 % | 22 сент. 2025 г. |
21Наблюдать | CVE-2025-59582Proof of concept | WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerabilitydarren cooney · ajax load more · CWE-497 | Средняя5,3 | — | 0,7 % | 22 сент. 2025 г. |
66На этой неделе | CVE-2025-59528Готовый эксплойт | Flowise has Remote Code Execution vulnerabilityflowiseai · flowise · CWE-94 | Критическая10,0 | — | 86,4 % | 22 сент. 2025 г. |
34Наблюдать | CVE-2025-59532Proof of concept | Codex has sandbox bypass due to bug in path configuration logicopenai · codex · CWE-20 | Высокая8,6 | — | 0,8 % | 22 сент. 2025 г. |
96Срочно | CVE-2025-26399Готовый эксплойт | SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerabilitysolarwinds · web help desk · CWE-502 | Критическая9,8 | KEV | 90,5 % | 23 сент. 2025 г. |
39Наблюдать | CVE-2025-10147Proof of concept | Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Uploadeteubert · podlove podcast publisher · CWE-434 | Критическая9,8 | — | 0,9 % | 23 сент. 2025 г. |
33Наблюдать | CVE-2025-10184Proof of concept | OnePlus OxygenOS Telephony provider permission bypassoneplus · oxygenos · CWE-89 | Высокая8,2 | — | 4,4 % | 23 сент. 2025 г. |
30Наблюдать | CVE-2025-55780Proof of concept | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document.artifex · mupdf · CWE-476 | Высокая7,5 | — | 0,4 % | 23 сент. 2025 г. |
26Наблюдать | CVE-2025-56311Proof of concept | In Shenzhen C-Data Technology Co.CWE-352 | Средняя6,5 | — | 0,1 % | 23 сент. 2025 г. |
31Наблюдать | CVE-2025-23339Proof of concept | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by getnvidia · cuda toolkit · CWE-121 | Высокая7,8 | — | 0,3 % | 24 сент. 2025 г. |
29Наблюдать | CVE-2025-48868Proof of concept | Horilla vulnerable to authenticated RCE via eval() in project_bulk_archivehorilla · horilla · CWE-95 | Высокая7,2 | — | 2,4 % | 24 сент. 2025 г. |
40В плане | CVE-2025-56819Proof of concept | An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.running-elephant · datart · CWE-78 | Критическая9,8 | — | 3,1 % | 24 сент. 2025 г. |
72На этой неделе | CVE-2025-10585Готовый эксплойт | Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craftedgoogle · chrome · CWE-843 | Критическая9,8 | KEV | 8,9 % | 24 сент. 2025 г. |
28Наблюдать | CVE-2025-56815Proof of concept | Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transfrunning-elephant · datart · CWE-22 | Высокая7,1 | — | 0,6 % | 24 сент. 2025 г. |
72На этой неделе | CVE-2025-20352Готовый эксплойт | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the fcisco · ios xe sd-wan · CWE-121 | Высокая7,7 | KEV | 40,5 % | 24 сент. 2025 г. |
41В плане | CVE-2025-52906Эксплойта нет | TOTOLINK X6000R Command Injection Vulnerabilitytotolink · x6000r firmware · CWE-78 | Критическая9,3 | — | 13,0 % | 24 сент. 2025 г. |
30Наблюдать | CVE-2025-57328Эксплойта нет | toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objjonschlinkert · toggle-array · CWE-1321 | Высокая7,5 | — | 0,3 % | 24 сент. 2025 г. |
38Наблюдать | CVE-2025-10894Proof of concept | Nx: nx/devkit: malicious versions of nx and plugins published to npmred hat · multicluster global hub · CWE-506 | Критическая9,6 | — | 0,5 % | 24 сент. 2025 г. |
22Наблюдать | CVE-2025-10951Proof of concept | geyang ml-logger server.py log_handler path traversalgeyang · ml-logger · CWE-22 | Средняя5,5 | — | 0,7 % | 25 сент. 2025 г. |
22Наблюдать | CVE-2025-10952Proof of concept | geyang ml-logger File server.py stream_handler information disclosuregeyang · ml-logger · CWE-200 | Средняя5,5 | — | 0,5 % | 25 сент. 2025 г. |
90Срочно | CVE-2025-20333Готовый эксплойт | A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Dcisco · adaptive security appliance software · CWE-120 | Критическая9,9 | KEV | 71,2 % | 25 сент. 2025 г. |
90Срочно | CVE-2025-20362Готовый эксплойт | Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTcisco · adaptive security appliance software · CWE-862 | Высокая8,6 | KEV | 87,0 % | 25 сент. 2025 г. |
42В плане | CVE-2025-34227Proof of concept | Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injectionnagios · nagios xi · CWE-78 | Высокая8,6 | — | 25,3 % | 25 сент. 2025 г. |
17Наблюдать | CVE-2025-10377Proof of concept | System Dashboard <= 2.8.20 - Cross-Site Request Forgeryqriouslad · system dashboard · CWE-352 | Средняя4,3 | — | 0,1 % | 26 сент. 2025 г. |
25Наблюдать | CVE-2025-9985Proof of concept | Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log Filemarceljm · featured image from url (fifu) · CWE-532 | Средняя5,3 | — | 12,3 % | 26 сент. 2025 г. |
26Наблюдать | CVE-2025-10307Proof of concept | Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletionsoftaculous · backuply – backup, restore, migrate and clone · CWE-22 | Средняя6,5 | — | 0,6 % | 26 сент. 2025 г. |
35Наблюдать | CVE-2025-55848Эксплойта нет | An issue was discovered in DIR-823 firmware 20250416.dlink · dir-823x firmware · CWE-77 | Высокая8,8 | — | 0,4 % | 26 сент. 2025 г. |
28Наблюдать | CVE-2025-9267Proof of concept | In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs fromseagate · toolkit · CWE-426 | Высокая7,0 | — | 0,2 % | 26 сент. 2025 г. |
33Наблюдать | CVE-2025-56383Proof of concept | Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code.CWE-427 | Высокая8,4 | — | 0,3 % | 26 сент. 2025 г. |
27Наблюдать | CVE-2025-59843Proof of concept | FlagForgeCTF Exposes User Emails via Public /api/user/[username] APIflagforge · flagforge · CWE-359 | Средняя6,9 | — | 0,4 % | 26 сент. 2025 г. |
40В плане | CVE-2025-59934Proof of concept | Formbricks missing JWT signature verificationformbricks · formbricks · CWE-287 | Критическая9,4 | — | 9,1 % | 26 сент. 2025 г. |
31Наблюдать | CVE-2025-9816Proof of concept | WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Headerveronalabs · wp statistics – simple, privacy-friendly google analytics alternative · CWE-79 | Высокая7,2 | — | 10,1 % | 27 сент. 2025 г. |
22Наблюдать | CVE-2025-11077Proof of concept | Campcodes Online Learning Management System add_content.php sql injectioncampcodes · online learning management system · CWE-74 | Средняя5,5 | — | 0,4 % | 27 сент. 2025 г. |
26Наблюдать | CVE-2025-57428Proof of concept | Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debugCWE-284 | Средняя6,5 | — | 0,2 % | 29 сент. 2025 г. |
43В плане | CVE-2025-8868Proof of concept | Chef Automate compliance service SQL Injection Vulnerabilitychef · automate · CWE-89 | Высокая8,8 | — | 25,9 % | 29 сент. 2025 г. |
30Наблюдать | CVE-2025-51495Proof of concept | An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17.cesanta · mongoose · CWE-190 | Высокая7,5 | — | 0,4 % | 29 сент. 2025 г. |
36Наблюдать | CVE-2025-56795Proof of concept | Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality.mealie · mealie · CWE-79 | Критическая9,0 | — | 0,3 % | 29 сент. 2025 г. |
24Наблюдать | CVE-2025-56807Proof of concept | A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScfairsketch · rise ultimate project manager · CWE-79 | Средняя6,1 | — | 0,2 % | 29 сент. 2025 г. |
32Наблюдать | CVE-2025-57483Proof of concept | A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the coCWE-79 | Высокая8,1 | — | 0,2 % | 29 сент. 2025 г. |
21Наблюдать | CVE-2025-56764Proof of concept | Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messtrivisionsecurity · trivision nc-227wf firmware · CWE-204 | Средняя5,3 | — | 0,2 % | 29 сент. 2025 г. |
64На этой неделе | CVE-2025-41244Готовый эксплойт | VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)vmware · aria operations · CWE-267 | Высокая7,8 | KEV | 8,6 % | 29 сент. 2025 г. |
27Наблюдать | CVE-2025-43400Proof of concept | An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 | Средняя6,3 | — | 6,9 % | 29 сент. 2025 г. |
37Наблюдать | CVE-2025-61584Proof of concept | serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflowserverless-dns · serverless-dns · CWE-77 | Критическая9,3 | — | 0,3 % | 30 сент. 2025 г. |
39Наблюдать | CVE-2025-8625Proof of concept | Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Executioncopypressdev · copypress rest api · CWE-321 | Критическая9,8 | — | 0,6 % | 30 сент. 2025 г. |
21Наблюдать | CVE-2025-56520Proof of concept | Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUplodify · dify · CWE-918 | Средняя5,3 | — | 0,6 % | 30 сент. 2025 г. |
39Наблюдать | CVE-2025-10725Proof of concept | Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster adminopendatahub-io · opendatahub-operator · CWE-266 | Критическая9,9 | — | 0,7 % | 30 сент. 2025 г. |
39Наблюдать | CVE-2025-56513Proof of concept | NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks.nicehash · quickminer · CWE-494 | Критическая9,8 | — | 0,4 % | 30 сент. 2025 г. |
29Наблюдать | CVE-2025-56132Proof of concept | LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality.liquidfiles · liquidfiles · CWE-305 | Высокая7,3 | — | 0,7 % | 30 сент. 2025 г. |
- CVE-2025-1044012Наблюдать
D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection
НизкаяCVSS 2,1Эксплойта нетEPSS 13 %d-link · di-810015 сент. 2025 г.
- CVE-2025-4640839Наблюдать
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpC
КритическаяCVSS 9,8Proof of conceptEPSS 0 %avtech · eagleeyes\(lite\)15 сент. 2025 г.
- CVE-2025-5011035Наблюдать
An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse m
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %15 сент. 2025 г.
- CVE-2025-5094435Наблюдать
An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %avtech · eagleeyes\(lite\)15 сент. 2025 г.
- CVE-2025-1044112Наблюдать
D-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injection
НизкаяCVSS 2,1Эксплойта нетEPSS 13 %d-link · di-8100g15 сент. 2025 г.
- CVE-2025-620228Наблюдать
Phoenix: Rowhammer attack on Hynix DDR5 devices
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %sk hynix · ddr515 сент. 2025 г.
- CVE-2025-5717440В плане
An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previo
КритическаяCVSS 9,8Proof of conceptEPSS 2 %15 сент. 2025 г.
- CVE-2025-5717626Наблюдать
On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP po
СредняяCVSS 6,5Proof of conceptEPSS 0 %ceragon networks / siklu communication · etherhaul and multihaul series microwave antennas15 сент. 2025 г.
- CVE-2025-5937621Наблюдать
feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-dele
СредняяCVSS 5,3Proof of conceptEPSS 0 %feisky · mcp-kubernetes-server15 сент. 2025 г.
- CVE-2025-980821Наблюдать
The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
СредняяCVSS 5,3Proof of conceptEPSS 0 %stellarwp · the events calendar16 сент. 2025 г.
- CVE-2025-240417Наблюдать
XSS in Ubit Information Technologies' STOYS
СредняяCVSS 4,3Proof of conceptEPSS 0 %ubit information technologies · stoys16 сент. 2025 г.
- CVE-2025-468839Наблюдать
SQLi in BGS Interactive's SINAV.LINK Exam Result Module
КритическаяCVSS 9,8Proof of conceptEPSS 0 %bgs interactive · sinav.link exam result module16 сент. 2025 г.
- CVE-2025-4124930Наблюдать
CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %vmware · spring framework16 сент. 2025 г.
- CVE-2009-2000560На этой неделе
InterSystems Caché UtilConfigHome.csp Stack Buffer Overflow
КритическаяCVSS 9,3Готовый эксплойтEPSS 1 %intersystems corporation · intersystems caché16 сент. 2025 г.
- CVE-2009-2000660На этой неделе
osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution
КритическаяCVSS 9,3Готовый эксплойтEPSS 1 %oscommerce · oscommerce16 сент. 2025 г.
- CVE-2009-2000760На этой неделе
Talkative IRC v0.4.4.16 Response Buffer Overflow
КритическаяCVSS 9,3Готовый эксплойтEPSS 1 %talkative · talkative irc16 сент. 2025 г.
- CVE-2025-4124341В плане
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
КритическаяCVSS 10,0Proof of conceptEPSS 3 %spring · cloud gateway16 сент. 2025 г.
- CVE-2025-921526Наблюдать
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Down
СредняяCVSS 6,5Proof of conceptEPSS 0 %kodezen · storeengine — complete ecommerce solution with memberships, licensing, affiliates & more17 сент. 2025 г.
- CVE-2025-921635Наблюдать
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Uplo
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %kodezen · storeengine — complete ecommerce solution with memberships, licensing, affiliates & more17 сент. 2025 г.
- CVE-2025-924295Срочно
WatchGuard Firebox iked Out of Bounds Write Vulnerability
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 92 %watchguard · fireware17 сент. 2025 г.
- CVE-2025-5945627Наблюдать
In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload
СредняяCVSS 5,5Эксплойта нетEPSS 15 %jetbrains · teamcity17 сент. 2025 г.
- CVE-2025-1004230Наблюдать
Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %ays-pro · quiz maker17 сент. 2025 г.
- CVE-2025-5947423Наблюдать
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible t
СредняяCVSS 5,3Proof of conceptEPSS 5 %jenkins · jenkins17 сент. 2025 г.
- CVE-2025-5705526Наблюдать
WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality.
СредняяCVSS 6,5Proof of conceptEPSS 0 %wondercms · wondercms17 сент. 2025 г.
- CVE-2025-5934130Наблюдать
Local File Inclusion in esm.sh
ВысокаяCVSS 7,7Proof of conceptEPSS 1 %esm-dev · esm.sh17 сент. 2025 г.
- CVE-2025-5934223Наблюдать
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
СредняяCVSS 5,5Proof of conceptEPSS 3 %esm-dev · esm.sh17 сент. 2025 г.
- CVE-2025-1062811Наблюдать
D-Link DIR-852 Web Management hedwig.cgi command injection
НизкаяCVSS 2,1Эксплойта нетEPSS 10 %dlink · dir-852 firmware17 сент. 2025 г.
- CVE-2025-1049321Наблюдать
Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie
СредняяCVSS 5,3Proof of conceptEPSS 0 %prasunsen · chained quiz18 сент. 2025 г.
- CVE-2025-4067734Наблюдать
SQL injection vulnerability in Summar Software´s Portal del Empleado
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %summar software · portal del empleado18 сент. 2025 г.
- CVE-2025-1066630Наблюдать
D-Link DIR-825 apply.cgi sub_4106d4 buffer overflow
ВысокаяCVSS 7,4Proof of conceptEPSS 3 %dlink · dir-825 firmware18 сент. 2025 г.
- CVE-2025-5591126Наблюдать
An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter
СредняяCVSS 6,5Proof of conceptEPSS 1 %oxygenz · clipbucket18 сент. 2025 г.
- CVE-2023-4936735Наблюдать
An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent pa
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %18 сент. 2025 г.
- CVE-2025-5591229Наблюдать
An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php t
ВысокаяCVSS 7,3Proof of conceptEPSS 1 %oxygenz · clipbucket18 сент. 2025 г.
- CVE-2025-5942429Наблюдать
LinkAce Vulnerable to Stored XSS on the Audit Page
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %linkace · linkace18 сент. 2025 г.
- CVE-2025-1003599Срочно
Deserialization Vulnerability in GoAnywhere MFT's License Servlet
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %fortra · goanywhere managed file transfer18 сент. 2025 г.
- CVE-2025-5971221Наблюдать
Snipe-IT before 8.1.18 allows XSS.
СредняяCVSS 5,4Proof of conceptEPSS 0 %snipeitapp · snipe-it18 сент. 2025 г.
- CVE-2025-4870396Срочно
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in t
КритическаяCVSS 9,0KEVГотовый эксплойтEPSS 99 %control-webpanel · webpanel19 сент. 2025 г.
- CVE-2025-5676224Наблюдать
Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php.
СредняяCVSS 6,1Proof of conceptEPSS 0 %paracrawl · keops19 сент. 2025 г.
- CVE-2025-5968960На этой неделе
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment.
СредняяCVSS 6,1KEVГотовый эксплойтEPSS 1 %libraesva · email security gateway19 сент. 2025 г.
- CVE-2025-3986631Наблюдать
fs: writeback: fix use-after-free in __mark_inode_dirty()
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux kernel19 сент. 2025 г.
- CVE-2025-1065826Наблюдать
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
СредняяCVSS 6,5Proof of conceptEPSS 0 %psmplugins · supportcandy – helpdesk & customer support ticket system20 сент. 2025 г.
- CVE-2025-107718Наблюдать
jeecgboot JimuReport DB2 JDBC testConnection deserialization
НизкаяCVSS 2,1Эксплойта нетEPSS 0 %jeecg · jimureport21 сент. 2025 г.
- CVE-2025-1077513Наблюдать
Wavlink WL-NU516U1 login.cgi sub_4012A0 os command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 16 %wavlink · wl-nu516u1 firmware21 сент. 2025 г.
- CVE-2025-998328Наблюдать
Lack of Authentication for RTSP stream
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %galayou · g222 сент. 2025 г.
- CVE-2025-5588525Наблюдать
SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate pri
СредняяCVSS 6,3Proof of conceptEPSS 0 %ard · gec en ligne22 сент. 2025 г.
- CVE-2025-5588626Наблюдать
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD.
СредняяCVSS 6,5Proof of conceptEPSS 0 %22 сент. 2025 г.
- CVE-2025-5588829Наблюдать
Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD.
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %ard · gec en ligne22 сент. 2025 г.
- CVE-2025-5236740В плане
Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field.
СредняяCVSS 5,4Готовый эксплойтEPSS 4 %pivotx · pivotx22 сент. 2025 г.
- CVE-2025-5588724Наблюдать
Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD.
СредняяCVSS 6,1Proof of conceptEPSS 0 %ard · gec en ligne22 сент. 2025 г.
- CVE-2025-5792626Наблюдать
WordPress Passster Plugin <= 4.2.18 - Cross Site Scripting (XSS) Vulnerability
СредняяCVSS 6,5Proof of conceptEPSS 0 %wp chill · passster22 сент. 2025 г.
- CVE-2025-5822621Наблюдать
WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure Vulnerability
СредняяCVSS 5,3Proof of conceptEPSS 0 %iberezansky · 3d flipbook – pdf flipbook viewer, flipbook image gallery22 сент. 2025 г.
- CVE-2025-5958221Наблюдать
WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability
СредняяCVSS 5,3Proof of conceptEPSS 0 %darren cooney · ajax load more22 сент. 2025 г.
- CVE-2025-5952866На этой неделе
Flowise has Remote Code Execution vulnerability
КритическаяCVSS 10,0Готовый эксплойтEPSS 86 %flowiseai · flowise22 сент. 2025 г.
- CVE-2025-5953234Наблюдать
Codex has sandbox bypass due to bug in path configuration logic
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %openai · codex22 сент. 2025 г.
- CVE-2025-2639996Срочно
SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 90 %solarwinds · web help desk23 сент. 2025 г.
- CVE-2025-1014739Наблюдать
Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 0 %eteubert · podlove podcast publisher23 сент. 2025 г.
- CVE-2025-1018433Наблюдать
OnePlus OxygenOS Telephony provider permission bypass
ВысокаяCVSS 8,2Proof of conceptEPSS 4 %oneplus · oxygenos23 сент. 2025 г.
- CVE-2025-5578030Наблюдать
A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %artifex · mupdf23 сент. 2025 г.
- CVE-2025-5631126Наблюдать
In Shenzhen C-Data Technology Co.
СредняяCVSS 6,5Proof of conceptEPSS 0 %23 сент. 2025 г.
- CVE-2025-2333931Наблюдать
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by get
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %nvidia · cuda toolkit24 сент. 2025 г.
- CVE-2025-4886829Наблюдать
Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive
ВысокаяCVSS 7,2Proof of conceptEPSS 2 %horilla · horilla24 сент. 2025 г.
- CVE-2025-5681940В плане
An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 3 %running-elephant · datart24 сент. 2025 г.
- CVE-2025-1058572На этой неделе
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 8 %google · chrome24 сент. 2025 г.
- CVE-2025-5681528Наблюдать
Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transf
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %running-elephant · datart24 сент. 2025 г.
- CVE-2025-2035272На этой неделе
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the f
ВысокаяCVSS 7,7KEVГотовый эксплойтEPSS 40 %cisco · ios xe sd-wan24 сент. 2025 г.
- CVE-2025-5290641В плане
TOTOLINK X6000R Command Injection Vulnerability
КритическаяCVSS 9,3Эксплойта нетEPSS 13 %totolink · x6000r firmware24 сент. 2025 г.
- CVE-2025-5732830Наблюдать
toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other obj
ВысокаяCVSS 7,5Эксплойта нетEPSS 0 %jonschlinkert · toggle-array24 сент. 2025 г.
- CVE-2025-1089438Наблюдать
Nx: nx/devkit: malicious versions of nx and plugins published to npm
КритическаяCVSS 9,6Proof of conceptEPSS 0 %red hat · multicluster global hub24 сент. 2025 г.
- CVE-2025-1095122Наблюдать
geyang ml-logger server.py log_handler path traversal
СредняяCVSS 5,5Proof of conceptEPSS 0 %geyang · ml-logger25 сент. 2025 г.
- CVE-2025-1095222Наблюдать
geyang ml-logger File server.py stream_handler information disclosure
СредняяCVSS 5,5Proof of conceptEPSS 0 %geyang · ml-logger25 сент. 2025 г.
- CVE-2025-2033390Срочно
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat D
КритическаяCVSS 9,9KEVГотовый эксплойтEPSS 71 %cisco · adaptive security appliance software25 сент. 2025 г.
- CVE-2025-2036290Срочно
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FT
ВысокаяCVSS 8,6KEVГотовый эксплойтEPSS 87 %cisco · adaptive security appliance software25 сент. 2025 г.
- CVE-2025-3422742В плане
Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection
ВысокаяCVSS 8,6Proof of conceptEPSS 25 %nagios · nagios xi25 сент. 2025 г.
- CVE-2025-1037717Наблюдать
System Dashboard <= 2.8.20 - Cross-Site Request Forgery
СредняяCVSS 4,3Proof of conceptEPSS 0 %qriouslad · system dashboard26 сент. 2025 г.
- CVE-2025-998525Наблюдать
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
СредняяCVSS 5,3Proof of conceptEPSS 12 %marceljm · featured image from url (fifu)26 сент. 2025 г.
- CVE-2025-1030726Наблюдать
Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion
СредняяCVSS 6,5Proof of conceptEPSS 0 %softaculous · backuply – backup, restore, migrate and clone26 сент. 2025 г.
- CVE-2025-5584835Наблюдать
An issue was discovered in DIR-823 firmware 20250416.
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %dlink · dir-823x firmware26 сент. 2025 г.
- CVE-2025-926728Наблюдать
In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from
ВысокаяCVSS 7,0Proof of conceptEPSS 0 %seagate · toolkit26 сент. 2025 г.
- CVE-2025-5638333Наблюдать
Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code.
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %26 сент. 2025 г.
- CVE-2025-5984327Наблюдать
FlagForgeCTF Exposes User Emails via Public /api/user/[username] API
СредняяCVSS 6,9Proof of conceptEPSS 0 %flagforge · flagforge26 сент. 2025 г.
- CVE-2025-5993440В плане
Formbricks missing JWT signature verification
КритическаяCVSS 9,4Proof of conceptEPSS 9 %formbricks · formbricks26 сент. 2025 г.
- CVE-2025-981631Наблюдать
WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
ВысокаяCVSS 7,2Proof of conceptEPSS 10 %veronalabs · wp statistics – simple, privacy-friendly google analytics alternative27 сент. 2025 г.
- CVE-2025-1107722Наблюдать
Campcodes Online Learning Management System add_content.php sql injection
СредняяCVSS 5,5Proof of conceptEPSS 0 %campcodes · online learning management system27 сент. 2025 г.
- CVE-2025-5742826Наблюдать
Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug
СредняяCVSS 6,5Proof of conceptEPSS 0 %29 сент. 2025 г.
- CVE-2025-886843В плане
Chef Automate compliance service SQL Injection Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 25 %chef · automate29 сент. 2025 г.
- CVE-2025-5149530Наблюдать
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %cesanta · mongoose29 сент. 2025 г.
- CVE-2025-5679536Наблюдать
Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality.
КритическаяCVSS 9,0Proof of conceptEPSS 0 %mealie · mealie29 сент. 2025 г.
- CVE-2025-5680724Наблюдать
A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaSc
СредняяCVSS 6,1Proof of conceptEPSS 0 %fairsketch · rise ultimate project manager29 сент. 2025 г.
- CVE-2025-5748332Наблюдать
A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the co
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %29 сент. 2025 г.
- CVE-2025-5676421Наблюдать
Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error mess
СредняяCVSS 5,3Proof of conceptEPSS 0 %trivisionsecurity · trivision nc-227wf firmware29 сент. 2025 г.
- CVE-2025-4124464На этой неделе
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 8 %vmware · aria operations29 сент. 2025 г.
- CVE-2025-4340027Наблюдать
An out-of-bounds write issue was addressed with improved bounds checking.
СредняяCVSS 6,3Proof of conceptEPSS 6 %apple · ipados29 сент. 2025 г.
- CVE-2025-6158437Наблюдать
serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow
КритическаяCVSS 9,3Proof of conceptEPSS 0 %serverless-dns · serverless-dns30 сент. 2025 г.
- CVE-2025-862539Наблюдать
Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution
КритическаяCVSS 9,8Proof of conceptEPSS 0 %copypressdev · copypress rest api30 сент. 2025 г.
- CVE-2025-5652021Наблюдать
Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUplo
СредняяCVSS 5,3Proof of conceptEPSS 0 %dify · dify30 сент. 2025 г.
- CVE-2025-1072539Наблюдать
Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin
КритическаяCVSS 9,9Proof of conceptEPSS 0 %opendatahub-io · opendatahub-operator30 сент. 2025 г.
- CVE-2025-5651339Наблюдать
NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks.
КритическаяCVSS 9,8Proof of conceptEPSS 0 %nicehash · quickminer30 сент. 2025 г.
- CVE-2025-5613229Наблюдать
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality.
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %liquidfiles · liquidfiles30 сент. 2025 г.